Inactive

March 12, 2020 Amendment 0002- Attachment 1: Questions and Answers March 3, 2020: Amendment 0001 updates Section 3.1.1 Bullet 2. Changes are highlighted in Bold Italics. **Please note the FAR referenc... March 12, 2020 Amendment 0002- Attachment 1: Questions and Answers March 3, 2020: Amendment 0001 updates Section 3.1.1 Bullet 2. Changes are highlighted in Bold Italics. **Please note the FAR references cited in beta.SAM are not applicable to the Federal Aviation Administration (FAA) as the FAA has its own policies and guidance referenced in the Acquisition Management System (AMS)** 1.0 PURPOSE AND INTRODUCTION: This announcement is a Market Survey. This announcement is NOT A SCREENING INFORMATION REQUEST (SIR) or REQUEST FOR PROPOSAL (RFP). Further, the FAA is not seeking or accepting unsolicited proposals. The FAA will not pay for any information received or costs incurred in preparing the response to the Market Survey. Any costs associated with the Market Survey submittal is solely at the interested vendor’s expense. Please read the entire Market Survey carefully. The FAA is seeking industry capability statements and technical approaches to determine the existence of any viable commercial solutions present in the current marketplace and to help determine the proper acquisition strategy for this requirement. No notification about the outcome of this Market Survey will be released except as deemed appropriate in the FAA’s sole discretion. The FAA is interested in the capabilities of both small and other than small businesses to perform the services and is particularly interested in the capabilities of small business and strongly encourages responses from those businesses. This Market Survey does not guarantee that a solicitation or procurement of any kind will be issued and it should not be construed as a commitment by the Government to enter into a contract. If a solicitation is issued, it will be announced on the Government's Contract Opportunities web page at beta.SAM.gov. It is the prospective offeror's responsibility to monitor this site for the release of any such solicitation. Respondents to this Market Survey are referred to herein as “you”, “Vendor”, or “Vendors”. 2.0 BACKGROUND: The FAA utilizes products provided by Microsoft pursuant to a combination of FAA-licensed Microsoft M365 E3 and Microsoft M365 E5 subscriptions hosted in Microsoft’s Government Community Cloud (GCC). Several components of the M365 E3 / E5 products enable FAA’s employees to create, store, transmit, and delete email, chat messages, audio files, video files, and numerous other file types. Appendix A lists the M365 E3 / E5 products and services along with the associated data / file types for each product. (Collectively the “GCC User Data Types”.) The FAA has a need for a vendor-provided FISMA-accredited archiving service (the “Archiving Service”) and associated data migration. The Archiving Service is not intended to replace the capabilities in GCC of Microsoft’s records management, Security and Compliance, or eDiscovery features. Currently, the FAA utilizes an email archiving service provided by Proofpoint Inc., via the services of third party integrators, which includes: Capture of messages before they are delivered to the end users mailboxes. Transmittal of those messages to, and storage at a data center operated by Proofpoint. The FAA currently utilizes the services of CSRA Inc. as integrator for Proofpoint services. There are approximately 64,000 active and 40,000 inactive Exchange Online user accounts at this time whose data is retained in Proofpoint’s archiving service pursuant to the FAA’s record obligations. Currently, the FAA does not have an archiving service within GCC, or otherwise, for any of the GCC User Data Types stored within GCC, except for email messages, archived using the Proofpoint service. 3.0 ARCHIVING AND DATA MIGRATION REQUIREMENTS 3.1 ARCHIVING REQUIREMENTS The FAA requires an Archiving Service that: Performs the functions of the existing Proofpoint email archiving service utilized by the FAA: Capture of messages before they are delivered to the end users mailboxes. Transmittal of those messages to, and storage at, a data center operated by the successor contractor. 2. Provides all the capabilities listed in Sections 5 and 7, below. 3.2 DATA MIGRATION REQUIREMENTS The FAA requires the migration of existing stores of archived email (approximately 350 terabytes) from the Proofpoint data center to the data center where the successor contractor will store the email and messaging data. For the Archiving Service, all metadata must be preserved on all migrated messaging data. 4.0 SUBMITTAL REQUIREMENTS AND INSTRUCTIONS: The FAA is requesting that interested Vendors provide the following: 1. Capability Statement covering: a. Archiving Functions (See Section 5, below) b. Data Migration (see Section 6, below) 2. Technical Approach and Security Compliance (see Section 7, below) 3. Describe the pricing schemes you would offer in providing the requirements identified in Sections 5, 6, and 7, below. For example: flat rate pricing; pricing per terabyte or other unit of storage, or other scheme or combinations of schemes. The Capability Statement and Technical Approach submission must follow the outline below and be limited to a combined total of ten (10) pages. Market Survey responses must be submitted via electronic mail (email) to the Contracting Officer, Frances Marigliano at Frances.Marigliano@faa.gov, with a copy to Contracting Specialist, Lisen Minetti at Lisen.C.Minetti@faa.gov no later than March 20, 2020 by 5:00 pm ET. Questions must be submitted in writing prior to the closing date and directed to Frances.Marigliano@faa.gov and Lisen.C.Minetti@faa.gov. All submissions must be Times New Roman font, 12-point size text and be compatible with either Microsoft Word format or Adobe Acrobat PDF. If chosen to submit via Adobe Acrobat PDF format, please ensure the document retains the ability to copy and paste into a MS Word Document (i.e. do not submit picture files). In addition to the Capability Statement and Technical Approach, the FAA encourages Vendors to submit comments and suggestions regarding this effort, including alternative approaches to meeting the FAA requirements. Comments and suggestions must be provided separately from the Capability Statement and Technical Approach and are limited to a combined total of five (5) pages. A vendor's failure to respond to this Market Survey will not exclude a vendor from the competition. Any information provided under this Market Survey is for informational purposes only and will not be released to the public except as required under the Freedom of Information Act (FOIA) or any other applicable law, regulation and/or policy. Any proprietary information submitted must be conspicuously marked as proprietary. The Government, to the extent permitted by law and regulation, will safeguard and treat information obtained pursuant to the vendor's disclosure as confidential where the information has been marked 'confidential' or 'proprietary' by the company. To the extent permitted by law and regulation, such information will not be released by the Government to the public pursuant to a FOIA request, 5 U.S.C. Section 552, without prior notification to the vendor. The Government may transfer documents provided by the vendor to any department or agency within the Executive Branch if the information relates to matters within the organization's jurisdiction. 5.0 ARCHIVING FUNCTIONS Describe your ability to execute the performance objectives below. This description must include examples demonstrating your experience and identify if the experience was performed as a prime or sub-contractor. Experiences must be actual prior government (federal, state or local) or commercial work experiences of similar size, scope and complexity to the requirements contemplated in this Market Survey. Please limit discussion to relevant current or previous experience that was substantially performed within the last three years. The Required Functions Capability Statement should address each of the following: The Archiving Service must give individual users and authorized administrators the ability to search and access archived messages using advanced features such as classification, categorization, and tagging; rendering and viewing; and exporting. The Archiving Service must provide the following capabilities: Automatically capture all GCC User Data Types designated by FAA administrators of the Archiving Service; Capture and preserve all GCC User Data Types before they arrive at the end user’s account in GCC; Capture all metadata in transit (journaled) for all GCC User Data Types in transit to each individual end user account in GCC; Transmit the captured data and store it in an encrypted form (FIPS 140-2 compliant), in transit and at rest, at a data archiving center operated by the Vendor, or operated by a third party certified by the Vendor; Create and manage retention policies; Export multiple email or chat messages into individual PDFs (one per message), including full versions of any message attachments; Grant access of an employee’s Archiving Service account to another employee – for example, their manager if the employee leaves the FAA; Search and view archived email, chat messages, and files to: Conduct keyword search and use wildcard, Boolean, and regular expressions; Search on one or more specific fields such as sender, recipient, attachments, body, or message header; Use Boolean logic across different parts of the e-mail: for example, “header contains ‘this’ AND attachment contains ‘that’”; Ability to search on specific timeframe (for example: Start-End, Before, After or On); Use advance search to exclude “Key terms” from Header, Subject, Body, attachments or File name; Ability to apply deduplication and near deduplications capabilities to the search result; Text analytics and machine learning capabilities; Email thread analysis capabilities; Search Microsoft Teams Channels where text, audio, and video conversations occur; and, Create search rules and alert if a rule is triggered. Alerts can be in the form of an email or other mechanism. Export archived email, chat messages, and documents: In bulk datasets such as multiple data sets at one time and in various formats (minimally including: PDF, PST, and EDRM file formats); and, To approved third-party applications; Create and manage legal holds on data stored in the Archiving Service – custodian based or ad hoc (keywords); Dispose of archived email, chat messages, and files that have met their relevant retention schedules or part of a spillage event (classified, PII, etc.); Ability to designate a retention schedule for each component of User Data, and to automatically apply tags or labels to each of the User Data Types; View and export available reports, including: Metrics; and, User access logs showing what a user did while on the system; and, Create predefined classification policies (i.e., Info Tags) on data as it is processed. Provide administrative features for designated FAA personnel (the “FAA Designated Agent(s)”) to: Activate or deactivate the Archiving Service for individual end user accounts in GCC, or groups of end user accounts specified by the FAA Designated Agents; Designate, both globally and on an account-by-account basis, the GCC User Data Types that the Archiving Service will capture; Create multiple content- or role-based retention policies with different retention periods, all either upon ingestion of an email message/attachment or retroactively after ingestion, according to the specific retention periods; Search according to sender/recipient information; content (keywords, phrases, Boolean); subject, date, and attachment (content and metadata). Once located, an email, message, or file, and any associated attachments and metadata can be viewed and, if necessary, retrieved back to the user’s mailbox for additional use; and, Save searches for future use. The FAA must be able to create and maintain configuration options for its archiving policies and grant control over who can access the archive. The FAA must have the ability to own and maintain a distribution group of all mailboxes intended for archiving, with all content preserved in a native or nonproprietary format for the designated retention period. 6.0 DATA MIGRATION Describe your capability and approach to perform the data migration requirements identified in Section 3.2, above. 7.0 TECHNICAL APPROACH AND SECURITY REQUIREMENTS Describe your Technical Approach by addressing items in paragraph 7.1 and how you would satisfy the Security Requirements in paragraph 7.2, below. 7.1 Technology Employed Describe the technology that Vendor’s Archiving Service will employ to fulfill each of the requirements in Sections 5 and 6, above. Explain the implementation and post-implementation operations approach for setting up the Vendor’s Archiving Service for FAA. For example, are both the implementation phase and post-implementation operations phase solely performed by the Vendor? Or are the services of a third-party integrator required for the implementation and post-implementation operations phases? Or some other approach? Will the data to be stored by the Vendor’s Archiving Service be stored in the Vendor’s own cloud, or in some third-party cloud? If a third-party cloud is required, please indicate which one(s). 7.2 Security Requirements Describe how you would satisfy each of the following Security Requirements: Establish secure, encrypted transmittal of GCC User Data Types from the GCC environment to the Vendor’s data center. Provide administrative capability to hide a document from view of anyone but an administrator. The Vendor’s Archiving Service must comply with National Archives and Records Administration (NARA) requirements applicable to the operation of an archiving system, The Vendor’s Archiving Service must provide periodic backup, recovery, and refresh operations, and the Vendor must be prepared to provide a Service Level Agreement (SLA) covering performance of these features. The Archiving Service must support the export of content to DoD 5015- or NARA-compliant repositories for items requiring records classification, all as stipulated through FAA requirements. Comply with the requirements of the FISMA and NIST standards for Moderate Impact systems (as defined by NIST Federal Information Processing Standard (FIPS) 199 and NIST SP 800-53, latest, currently Rev 4); and meeting FedRAMP requirements if cloud solution. Supply the FAA’s Cyber Security Management Center (CSMC), Office of Investigations, or the U.S. Computer Emergency Readiness Team (US-CERT) with access to security logs and other incident information in accordance with US-CERT reporting requirements specified in the US-CERT Federal Incident Reporting Guidelines to investigate potential security events. Comply with International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001:2005 and 27002:2005. The Archiving Service and the Vendor’s cloud service provider (CSP) must be FedRAMP certified. Please provide the relevant FedRAMP ID(s) with your technical approach. Use a FedRAMP approved independent third party to perform an initial security assessment of the cloud service and on-going monitoring of controls. Provide the necessary information for use by the FAA in moving towards compliance with NIST Special Publication 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. Comply with FedRAMP requirements. Provide and maintain the following artifacts: Privacy Threshold Assessment (PTA)/Privacy Impact Assessment (PIA) FedRAMP Security Authorization Documents Security Assessment Report Security Plan Plan of Action and Milestones (POA&M) Continuous Monitoring Plan FedRAMP Monthly Continuous Monitoring submittals 8.0 NON-GOVERNMENT PERSONNEL PARTICIPATION: The FAA may utilize contract support personnel in meeting with customer organizations and reviewing Vendor submissions. Contract support personnel will sign all relevant Non-Disclosure of Information and Conflict of Interest Agreements for any subsequent acquisition. 9.0 OTHER: It is highly recommended that interested Vendors check the Government’s Contracting Opportunities website frequently for any updates and amendments to this announcement. Also, if this announcement is being viewed from other than the Government’s Contracting Opportunities website, some information and/or attachments may not transfer correctly. Therefore, only the information and attachments provided at are considered the “official” source of information on this requirement. The FAA may request that one, some, all, or none of the respondents to this Market Survey provide additional information. No evaluation of vendors will occur based on this additional information, and vendor participation in any informational session is not a promise for future business with the FAA.